evolcore 0.0.12 → 0.0.13

package/CHANGELOG.md

@@ -3,6 +3,28 @@
 本文件记录 EvolCore 的重要变更。EvolClaw 版本线的历史记录已归档至
 [`docs/_archive/CHANGELOG-evolclaw.md`](docs/_archive/CHANGELOG-evolclaw.md)。
 
+## 0.0.13 (2026-08-20)
+
+### AUN 消息与文件
+
+- 显式区分 AUN 私聊与群聊投递路由，强化入站去重、顺序处理、消息队列持久化和失败恢复。
+- 统一 AUN RPC 与存储客户端，扩展群文件写入与下载能力，收敛文件操作和载荷处理边界。
+- 增加群文件下载票据校验和内容哈希验证，补齐短连接 RPC、存储上传及启动期角色配置迁移能力。
+
+### 权限与关系
+
+- 收敛角色迁移、权限作用域和最小能力模式，强化 Owner、关系范围与工具执行审计边界。
+- 贯通会话投递元数据和跨会话授权校验，避免托管操作越过当前 Agent、会话或关系范围。
+- 强化受管 `$TMPDIR`、群规则读取和群文件上传的路径隔离，拒绝符号链接、越界目录及不符合权限/所有者要求的路径。
+- 完善菜单授权审计的请求与会话关联信息，扩展只读 Shell 查询、配置批量读取和委派有效期校验。
+
+### 会话与运行时
+
+- 完善消息撤回隔离、错误回传、菜单交互、重启命令和 Trigger 反馈的上下文校验。
+- 简化 Agent 运行器与启动流程，修正系统重启路径并清理托管会话凭据。
+- 为 Codex app-server 请求增加 request ID 与载荷指纹重放防护，使重复请求复用结果、冲突请求拒绝；会话重试按至多执行一次处理。
+- 统一 EC Web 守护进程的发现、接管、健康检查和退出清理，修正 Linux 进程启动时间计算，并改进 Codex 初始化/升级探测与 Web 消息路由展示。
+
 ## 0.0.12 (2026-08-19)
 
 ### AUN 通信

package/bin/ec-safe-output.js

@@ -82,12 +82,27 @@ function resolveExecutionPaths(payload) {
   return { workspace, cwd };
 }
 
+function resolveManagedTempRoot() {
+  const raw = typeof process.env.TMPDIR === 'string' ? process.env.TMPDIR.trim() : '';
+  if (!raw || !path.isAbsolute(raw)) fail('managed TMPDIR is unavailable');
+  try {
+    const root = fs.realpathSync(raw);
+    if (!fs.statSync(root).isDirectory()) fail('managed TMPDIR is not a directory');
+    return root;
+  } catch {
+    fail('managed TMPDIR is unavailable');
+  }
+}
+
 function openOutputFile(payload, paths) {
   if (payload.outputPath === undefined) return undefined;
-  if (typeof payload.outputPath !== 'string' || !payload.outputPath || path.isAbsolute(payload.outputPath)) {
-    fail('output path must be relative');
-  }
-  const target = path.resolve(paths.cwd, payload.outputPath);
+  if (typeof payload.outputPath !== 'string' || !payload.outputPath) fail('output path is invalid');
+
+  const isManagedTempOutput = path.isAbsolute(payload.outputPath);
+  const outputRoot = isManagedTempOutput ? resolveManagedTempRoot() : paths.workspace;
+  const target = isManagedTempOutput
+    ? path.resolve(payload.outputPath)
+    : path.resolve(paths.cwd, payload.outputPath);
   const parent = path.dirname(target);
   let realParent;
   try {
@@ -97,9 +112,13 @@ function openOutputFile(payload, paths) {
     fail('output parent does not exist');
   }
   const canonicalTarget = path.join(realParent, path.basename(target));
-  if (!sameOrDescendant(canonicalTarget, paths.workspace)) fail('output path escapes workspace');
-  const relative = path.relative(paths.workspace, canonicalTarget);
-  if (relative === '.git' || relative.startsWith(`.git${path.sep}`)) fail('output path may not target Git metadata');
+  if (!sameOrDescendant(canonicalTarget, outputRoot)) {
+    fail(isManagedTempOutput ? 'output path escapes managed TMPDIR' : 'output path escapes workspace');
+  }
+  if (!isManagedTempOutput) {
+    const relative = path.relative(paths.workspace, canonicalTarget);
+    if (relative === '.git' || relative.startsWith(`.git${path.sep}`)) fail('output path may not target Git metadata');
+  }
 
   const noFollow = fs.constants.O_NOFOLLOW ?? 0;
   try {

package/dist/agents/claude-runner.js

@@ -20,10 +20,9 @@ import { getPackageRoot, resolvePaths } from '../paths.js';
 import { resolveEffective } from '../config/config-manager.js';
 import { sanitizeSessionTitle } from '../core/session/session-title.js';
 import { resolveClaudeCapabilityRunOptionsForProject } from '../core/capability/capability-manager.js';
-import { normalizePermissionMode } from '../core/permission/mode.js';
-import { resolvePhaseOneExecutionSandbox } from '../core/permission/execution-sandbox.js';
+import { normalizePermissionMode, resolvePhaseOneExecutionSandbox } from '../core/permission/mode.js';
 import { buildClaudeProtectedFilesystem, containsHClassReference, containsLClassReference, isHClassPath, isLClassPath, resolveProtectedCandidate, } from '../core/protected-paths.js';
-import { buildHClassGuardCommand, ensureClaudeGitWorktreeConfig, prependExecutableDirectory, resolveBubblewrapPath, shouldFailIfClaudeSandboxUnavailable, } from '../core/permission/sandbox-runtime.js';
+import { buildHClassGuardCommand, createSandboxInitializationError, isSandboxInitializationFailure, SANDBOX_INITIALIZATION_FAILED, ensureClaudeGitWorktreeConfig, prependExecutableDirectory, resolveBubblewrapPath, shouldFailIfClaudeSandboxUnavailable, } from '../core/permission/sandbox-runtime.js';
 import { buildClaudeUnixSocketAllowlist } from '../core/permission/unix-socket-policy.js';
 import { contextTokensForUsage, usageForContext, isClaudeContextUsageModel, isOneMillionContextModel, realContextWindowForModel, autoCompactWindowForModel } from './runner-types.js';
 export { hasCompact, hasModelSwitcher, hasPermissionController } from './runner-types.js';
@@ -1759,6 +1758,30 @@ export class AgentRunner {
             else {
                 logger.error(`[AgentRunner] Subprocess stream failed (session=${sessionId}) with no captured stderr.`);
             }
+            if (isSandboxInitializationFailure(err, buf ?? [])) {
+                const detail = createSandboxInitializationError(err, buf ?? []);
+                await this.permissionContexts.get(sessionId)?.recordExecutionAnomaly?.({
+                    code: 'capability_unavailable',
+                    severity: 'warning',
+                    phase: 'execution',
+                    occurredAt: Date.now(),
+                    toolName: 'Bash',
+                    policyCode: SANDBOX_INITIALIZATION_FAILED,
+                    decisionSource: 'infrastructure',
+                    agentAid: this.permissionContexts.get(sessionId)?.selfAid,
+                    summary: detail.message.slice(0, 512),
+                    effect: 'operation_skipped',
+                });
+                yield {
+                    type: 'complete',
+                    isError: true,
+                    subtype: 'infrastructure',
+                    terminalReason: SANDBOX_INITIALIZATION_FAILED,
+                    errors: [detail.message],
+                    queryFinal: true,
+                };
+                return;
+            }
             throw err;
         }
         finally {
@@ -1865,6 +1888,9 @@ export class AgentRunner {
                     toolName,
                     ...(typeof requestId === 'string' && requestId ? { requestId } : {}),
                     policyCode: code,
+                    decisionSource: 'policy',
+                    agentAid: this.permissionContexts.get(sessionId)?.selfAid,
+                    permissionMode: callPermissionMode,
                     summary: summarizeToolInputForAudit(toolName, toolInput).slice(0, 512),
                     effect: 'operation_skipped',
                 });
@@ -1932,6 +1958,7 @@ export class AgentRunner {
                 role: permCtx?.role,
                 permissionMode: callPermissionMode,
                 allowHostProcessCommands: true,
+                allowProtectedMetadata: false,
                 safeOutputHelperPath: path.join(getPackageRoot(), 'bin', 'ec-safe-output.js'),
                 projectPath,
             });
@@ -1963,10 +1990,11 @@ export class AgentRunner {
                     channel: permCtx?.channel,
                     peerId: permCtx?.userId,
                     role: permCtx?.role,
+                    allowProtectedMetadata: false,
                 };
                 const roResult = checkReadonly(toolName, toolInput, projectPath, readonlyContext);
                 if (roResult.behavior === 'deny') {
-                    await recordPreflightDenial(toolName, toolInput, undefined, input.tool_use_id ?? input.toolUseID, 'readonly_mode');
+                    await recordPreflightDenial(toolName, toolInput, undefined, input.tool_use_id ?? input.toolUseID, roResult.policyCode ?? 'readonly_mode');
                     return hookDecision('deny', roResult.message, updatedInput);
                 }
                 return hookDecision('allow', undefined, updatedInput);
@@ -2052,6 +2080,7 @@ export class AgentRunner {
                 role: permCtx?.role,
                 permissionMode: callPermissionMode,
                 allowHostProcessCommands: true,
+                allowProtectedMetadata: false,
                 safeOutputHelperPath: path.join(getPackageRoot(), 'bin', 'ec-safe-output.js'),
                 projectPath,
             });
@@ -2119,10 +2148,11 @@ export class AgentRunner {
                     channel: permCtx?.channel,
                     peerId: permCtx?.userId,
                     role: permCtx?.role,
+                    allowProtectedMetadata: false,
                 };
                 const roResult = checkReadonly(toolName, input, projectPath, readonlyContext);
                 if (roResult.behavior === 'deny') {
-                    await recordPreflightDenial(toolName, input, undefined, options.toolUseID, 'readonly_mode');
+                    await recordPreflightDenial(toolName, input, undefined, options.toolUseID, roResult.policyCode ?? 'readonly_mode');
                     return { behavior: 'deny', message: roResult.message, decisionClassification: 'user_reject' };
                 }
                 return { behavior: 'allow', updatedInput: input, decisionClassification: 'user_permanent' };
@@ -2373,12 +2403,28 @@ export class AgentRunner {
             logger.info('[AgentRunner] Creating query with images:', images.length, 'first image size:', images[0]?.data?.length ?? 0);
             logger.debug('[AgentRunner] Skipping resume for image message to avoid history conflict');
             msgStream.push(prompt, images, inputId);
-            sdkStream = createQuery(msgStream);
+            try {
+                sdkStream = createQuery(msgStream);
+            }
+            catch (error) {
+                const stderr = this.recentStderr.get(sessionId) ?? [];
+                if (isSandboxInitializationFailure(error, stderr))
+                    throw createSandboxInitializationError(error, stderr);
+                throw error;
+            }
         }
         else {
             logger.debug('[AgentRunner] Creating query with text only, agentSessionId:', initialClaudeSessionId);
             msgStream.push(prompt, undefined, inputId);
-            sdkStream = createQuery(msgStream, agentSessionId, resumeAt);
+            try {
+                sdkStream = createQuery(msgStream, agentSessionId, resumeAt);
+            }
+            catch (error) {
+                const stderr = this.recentStderr.get(sessionId) ?? [];
+                if (isSandboxInitializationFailure(error, stderr))
+                    throw createSandboxInitializationError(error, stderr);
+                throw error;
+            }
         }
         this.activeMessageStreams.set(sessionId, msgStream);
         this.activeQueries.set(sessionId, sdkStream);

package/dist/agents/codex-app-server-client.js

@@ -30,6 +30,22 @@ function runtimeProviderId(baseUrl) {
     const digest = createHash('sha256').update(baseUrl || 'default').digest('hex').slice(0, 12);
     return `evolcore_runtime_${digest}`;
 }
+function stableJson(value) {
+    if (Array.isArray(value))
+        return `[${value.map(stableJson).join(',')}]`;
+    if (value && typeof value === 'object') {
+        return `{${Object.entries(value)
+            .sort(([left], [right]) => left.localeCompare(right))
+            .map(([key, entry]) => `${JSON.stringify(key)}:${stableJson(entry)}`)
+            .join(',')}}`;
+    }
+    return JSON.stringify(value) ?? 'undefined';
+}
+function serverRequestFingerprint(request) {
+    return createHash('sha256')
+        .update(`${request.method}\n${stableJson(request.params)}`)
+        .digest('hex');
+}
 function hasPermissionProfile(config) {
     if (!config || typeof config.default_permissions !== 'string' || !config.default_permissions)
         return false;
@@ -41,6 +57,7 @@ export class CodexAppServerClient {
     options;
     proc = null;
     pending = new Map();
+    serverRequestReplays = new Map();
     notificationHandlers = new Set();
     nextId = 1;
     initialized = false;
@@ -305,6 +322,7 @@ export class CodexAppServerClient {
             pending.reject(new Error('Codex app-server closed'));
         }
         this.pending.clear();
+        this.serverRequestReplays.clear();
         if (!proc) {
             this.cleanupManagedHookRuntime();
             return;
@@ -627,15 +645,44 @@ export class CodexAppServerClient {
             this.respondError(request.id, new Error('Unsupported Codex app-server request: ' + request.method));
             return;
         }
-        Promise.resolve(handler(request))
+        const replayKey = String(request.id);
+        const fingerprint = serverRequestFingerprint(request);
+        const previous = this.serverRequestReplays.get(replayKey);
+        if (previous) {
+            if (previous.fingerprint !== fingerprint) {
+                const conflict = new Error(`Conflicting Codex app-server request payload for id=${request.id}`);
+                logger.warn(`[CodexAppServer] server request ID conflict id=${request.id} method=${request.method}`);
+                this.respondError(request.id, conflict);
+                return;
+            }
+            // A retry must receive a response too, but must never invoke the
+            // approval handler a second time.
+            this.respondFromPromise(request.id, request.method, previous.response);
+            return;
+        }
+        let response;
+        try {
+            // Invoke synchronously so existing app-server latency stays unchanged,
+            // while the explicit catch still turns a synchronous handler throw into
+            // the same replayable rejected response as an async failure.
+            response = Promise.resolve(handler(request));
+        }
+        catch (error) {
+            response = Promise.reject(error);
+        }
+        this.serverRequestReplays.set(replayKey, { fingerprint, response });
+        this.respondFromPromise(request.id, request.method, response);
+    }
+    respondFromPromise(id, method, response) {
+        response
             .then(result => {
-            logger.info(`[CodexAppServer] server response id=${request.id} method=${request.method} result=${JSON.stringify(result ?? null)}`);
-            this.respond(request.id, result ?? null);
+            logger.info(`[CodexAppServer] server response id=${id} method=${method} result=${JSON.stringify(result ?? null)}`);
+            this.respond(id, result ?? null);
         })
             .catch(error => {
             const err = error instanceof Error ? error : new Error(String(error));
-            logger.warn(`[CodexAppServer] server request failed id=${request.id} method=${request.method}: ${err.message}`);
-            this.respondError(request.id, err);
+            logger.warn(`[CodexAppServer] server request failed id=${id} method=${method}: ${err.message}`);
+            this.respondError(id, err);
         });
     }
     emitNotification(notification) {
@@ -676,6 +723,7 @@ export class CodexAppServerClient {
             pending.reject(error);
         }
         this.pending.clear();
+        this.serverRequestReplays.clear();
         this.cleanupManagedHookRuntime();
     }
 }

package/dist/agents/codex-runner.js

@@ -7,8 +7,7 @@
  */
 import { requestDangerousCommandPermission } from '../core/permission/approval-gateway.js';
 import { checkReadonly, checkDangerousCommand, evaluateToolPreflight } from '../core/permission/tool-policy.js';
-import { normalizePermissionMode } from '../core/permission/mode.js';
-import { resolvePhaseOneExecutionSandbox } from '../core/permission/execution-sandbox.js';
+import { normalizePermissionMode, resolvePhaseOneExecutionSandbox } from '../core/permission/mode.js';
 import { buildCodexProtectedFilesystemRules, isSameOrDescendant, resolveProtectedCandidate } from '../core/protected-paths.js';
 import { CodexAppServerClient } from './codex-app-server-client.js';
 import { resolveOpenaiConfig } from './baseagent.js';
@@ -76,6 +75,39 @@ class AsyncEventQueue {
 }
 const managedTempDirsForExitCleanup = new Map();
 let managedTempExitCleanupRegistered = false;
+function isTrustedManagedTempDirectory(directory, parent) {
+    try {
+        const parentPath = path.resolve(parent);
+        const directoryPath = path.resolve(directory);
+        // The session directory must be a direct child of the private parent.
+        // This lexical check is required before canonicalization so a replaced
+        // parent symlink cannot turn an old session path into another tree.
+        if (path.dirname(directoryPath) !== parentPath)
+            return false;
+        const trustedDirectory = (candidate) => {
+            const stat = fs.lstatSync(candidate);
+            if (!stat.isDirectory() || stat.isSymbolicLink())
+                return false;
+            if (typeof process.getuid === 'function' && stat.uid !== process.getuid())
+                return false;
+            return (stat.mode & 0o077) === 0;
+        };
+        if (!trustedDirectory(parentPath) || !trustedDirectory(directoryPath))
+            return false;
+        const canonicalParent = resolveProtectedCandidate(parentPath);
+        const canonicalDirectory = resolveProtectedCandidate(directoryPath);
+        // Keep the canonical and lexical paths identical after the lstat checks;
+        // this rejects symlink replacement in either node or an existing ancestor.
+        return canonicalParent === parentPath
+            && canonicalDirectory === directoryPath
+            && canonicalDirectory !== canonicalParent
+            && path.dirname(canonicalDirectory) === canonicalParent
+            && isSameOrDescendant(canonicalDirectory, canonicalParent);
+    }
+    catch {
+        return false;
+    }
+}
 function registerManagedTempDirForExitCleanup(directory, parent) {
     managedTempDirsForExitCleanup.set(directory, parent);
     if (managedTempExitCleanupRegistered)
@@ -84,10 +116,8 @@ function registerManagedTempDirForExitCleanup(directory, parent) {
     process.once('exit', () => {
         for (const [candidatePath, parentPath] of managedTempDirsForExitCleanup) {
             try {
-                const parentCandidate = resolveProtectedCandidate(parentPath);
-                const candidate = resolveProtectedCandidate(candidatePath);
-                if (candidate !== parentCandidate && isSameOrDescendant(candidate, parentCandidate)) {
-                    fs.rmSync(candidate, { recursive: true, force: true });
+                if (isTrustedManagedTempDirectory(candidatePath, parentPath)) {
+                    fs.rmSync(path.resolve(candidatePath), { recursive: true, force: true });
                 }
             }
             catch {
@@ -121,7 +151,7 @@ const CODEX_DELEGATION_CARRIER_METADATA_KEY = '__codexDelegationCarrierV1';
 let codexCatalogCache = null;
 // The permission bridge is version-locked to the audited approval schema and
 // managed PreToolUse hook behavior used by proactive first-tool enforcement.
-export const MIN_CODEX_CLI_VERSION = '0.147.0';
+export const MIN_CODEX_CLI_VERSION = '0.145.0';
 export function parseCodexCliVersion(output) {
     const match = output.match(/\b(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)\b/);
     return match?.[1] ?? null;
@@ -144,19 +174,18 @@ export function getCodexCliVersion() {
 }
 export function getCodexAppServerAvailability() {
     if (!resolveCodexCliPath()) {
-        const upgradeHint = '请升级 Codex CLI：npm install -g @openai/codex@latest';
-        return { available: false, reason: `未检测到可用 Codex CLI。${upgradeHint}` };
+        return { available: false, reason: '未检测到 Codex CLI。' };
     }
     const version = getCodexCliVersion();
-    const upgradeHint = '请升级 Codex CLI：npm install -g @openai/codex@latest';
     if (!version) {
-        return { available: false, reason: `未检测到可用 Codex CLI。${upgradeHint}` };
+        return { available: false, reason: '无法读取 Codex CLI 版本。' };
     }
     if (!isCodexCliVersionSupported(version)) {
         return {
             available: false,
             version,
-            reason: `Codex CLI ${version} 低于最低要求 ${MIN_CODEX_CLI_VERSION}。${upgradeHint}`,
+            reason: `Codex CLI ${version} 低于最低要求 ${MIN_CODEX_CLI_VERSION}。请升级 Codex CLI：npm install -g @openai/codex@latest`,
+            requiresUpgrade: true,
         };
     }
     try {
@@ -168,7 +197,7 @@ export function getCodexAppServerAvailability() {
         return { available: true, version };
     }
     catch {
-        return { available: false, version, reason: `Codex CLI ${version} 不支持 app-server。${upgradeHint}` };
+        return { available: false, version, reason: `Codex CLI ${version} 不支持 app-server。` };
     }
 }
 export function isCodexAppServerAvailable() {
@@ -208,6 +237,9 @@ export function getCodexEfforts(model) {
 // ── Codex Runner ──
 export class CodexRunner {
     name = 'codex';
+    // turn/start persists a new user turn before runQuery resolves. App-server
+    // has no retry-in-place API for a completed or failed turn.
+    retryInputSemantics = 'at_most_once';
     capabilities;
     model;
     effort;
@@ -282,16 +314,23 @@ export class CodexRunner {
     createDelegationCarrier() {
         return randomBytes(32).toString('base64url');
     }
-    approvedLiteralEvolcoreCommandArgv(command) {
+    approvedLiteralEvolcoreCommandArgv(command, managedTempDir) {
         const classification = classifyEvolcoreShellCommand(command);
         if (classification.kind === 'bounded-output')
             return classification.command.argv;
         if (classification.kind !== 'literal')
             return undefined;
-        const argv = parseLiteralShellArgv(command);
+        // Keep the approval/delegation parser aligned with the preflight parser:
+        // the session-managed `$TMPDIR` token is a permitted EC path reference.
+        const argv = parseLiteralShellArgv(command, {
+            allowManagedTmpDir: true,
+            ...(managedTempDir ? { managedTempDir } : {}),
+        });
+        if (argv?.some(value => value.includes('$TMPDIR')))
+            return undefined;
         return argv?.[0] === 'ec' ? argv : undefined;
     }
-    approvedEvolcoreCommandArgv(toolInput) {
+    approvedEvolcoreCommandArgv(toolInput, managedTempDir) {
         const explicitArgv = Array.isArray(toolInput.commandArgv)
             && toolInput.commandArgv.every(value => typeof value === 'string')
             ? toolInput.commandArgv
@@ -302,24 +341,27 @@ export class CodexRunner {
             ? unwrapCodexShellCommandArgv(explicitArgv)
             : undefined;
         if (explicitWrappedCommand !== undefined) {
-            return this.approvedLiteralEvolcoreCommandArgv(explicitWrappedCommand);
+            return this.approvedLiteralEvolcoreCommandArgv(explicitWrappedCommand, managedTempDir);
         }
         const command = typeof toolInput.command === 'string' ? toolInput.command : '';
-        const directArgv = this.approvedLiteralEvolcoreCommandArgv(command);
+        const directArgv = this.approvedLiteralEvolcoreCommandArgv(command, managedTempDir);
         if (directArgv)
             return directArgv;
-        const wrappedArgv = parseLiteralShellArgv(command);
+        const wrappedArgv = parseLiteralShellArgv(command, {
+            allowManagedTmpDir: true,
+            ...(managedTempDir ? { managedTempDir } : {}),
+        });
         const wrappedCommand = wrappedArgv
             ? unwrapCodexShellCommandArgv(wrappedArgv)
             : undefined;
         return wrappedCommand === undefined
             ? undefined
-            : this.approvedLiteralEvolcoreCommandArgv(wrappedCommand);
+            : this.approvedLiteralEvolcoreCommandArgv(wrappedCommand, managedTempDir);
     }
     armApprovedDelegationCommand(sessionId, toolInput) {
         const threadId = this.activeSessions.get(sessionId);
         const carrierToken = threadId ? this.threadDelegationCarriers.get(threadId) : undefined;
-        const argv = this.approvedEvolcoreCommandArgv(toolInput);
+        const argv = this.approvedEvolcoreCommandArgv(toolInput, this.getManagedTempDir(sessionId));
         if (!carrierToken || !argv)
             return false;
         const commandHash = hashDelegatedCommandArgv(argv);
@@ -1630,7 +1672,7 @@ export class CodexRunner {
             const decision = await this.resolvePermissionDecision(sessionKey, toolName, toolInput, summary, reason, workspacePath, operationCwd, request.id);
             if (decision !== 'deny'
                 && (request.method === 'item/commandExecution/requestApproval' || request.method === 'execCommandApproval')
-                && this.approvedEvolcoreCommandArgv(toolInput)) {
+                && this.approvedEvolcoreCommandArgv(toolInput, this.getManagedTempDir(sessionKey))) {
                 if (!this.armApprovedDelegationCommand(sessionKey, toolInput)) {
                     // Approval policy and delegation authority are separate boundaries.
                     // If no ticket can be armed, the CLI still fails closed at IPC token
@@ -2058,10 +2100,15 @@ export class CodexRunner {
             channel: permCtx?.channel,
             peerId: permCtx?.userId,
             role: permCtx?.role,
+            allowProtectedMetadata: false,
+            // Revalidate ownership, mode, and parent containment at the final
+            // readonly decision. The map entry alone is stale if the directory was
+            // replaced between preflight and the approval callback.
+            managedTempDir: this.getManagedTempDir(sessionKey),
         } : undefined;
         if (toolName === 'Bash')
             return checkReadonly(toolName, input, projectPath, readonlyContext);
-        return { behavior: 'deny', message: '🔒 只读模式：权限升级和文件写入请求已拒绝' };
+        return { behavior: 'deny', message: '🔒 只读模式：权限升级和文件写入请求已拒绝', policyCode: 'readonly_permission_or_write' };
     }
     permissionProfiles(input) {
         return [input.permissions, input.additionalPermissions]
@@ -2183,6 +2230,9 @@ export class CodexRunner {
                     toolName,
                     ...(typeof requestId === 'string' || typeof requestId === 'number' ? { requestId: String(requestId) } : {}),
                     policyCode,
+                    decisionSource: 'policy',
+                    agentAid: permissionContext?.selfAid,
+                    permissionMode: mode,
                     summary: summarizeToolInputForAudit(toolName, operationInput).slice(0, 512),
                     effect: 'operation_skipped',
                 });
@@ -2193,6 +2243,11 @@ export class CodexRunner {
         };
         const preflight = evaluateToolPreflight(toolName, toolInput, {
             sessionId: sessionKey,
+            // An unavailable registered root must fail closed; the policy helper
+            // distinguishes this explicit empty value from runners without a
+            // session-temp capability.
+            managedTempDir: this.getManagedTempDir(sessionKey) ?? '',
+            allowProtectedMetadata: false,
             selfAid: permissionContext?.selfAid,
             channel: permissionContext?.channel,
             userId: permissionContext?.userId,
@@ -2202,6 +2257,8 @@ export class CodexRunner {
             workspacePath,
         });
         if (preflight.behavior === 'deny') {
+            logger.warn(`[CodexRunner] tool preflight denied: session=${sessionKey} tool=${toolName} ` +
+                `policy=${preflight.policyCode ?? 'unknown'} reason=${preflight.message ?? 'policy denied'}`);
             if (preflight.policyCode) {
                 await recordBlockedOperation(preflight.policyCode);
             }
@@ -2231,7 +2288,7 @@ export class CodexRunner {
         if (mode === 'readonly') {
             const readonly = this.checkCodexReadonly(toolName, checkedInput, operationCwd, sessionKey);
             if (readonly.behavior === 'deny') {
-                await recordBlockedOperation('readonly_mode', checkedInput);
+                await recordBlockedOperation(readonly.policyCode ?? 'readonly_mode', checkedInput);
                 return 'deny';
             }
             return 'allow';
@@ -2636,19 +2693,18 @@ export class CodexRunner {
     *reconcileOpenAppServerToolCalls(state, turnId) {
         if (state.openToolCalls.size === 0)
             return;
-        const callIds = [...state.openToolCalls.keys()];
+        const openCalls = [...state.openToolCalls.entries()];
+        const callIds = openCalls.map(([callId]) => callId);
         logger.warn(`[CodexRunner] Turn completed with ${callIds.length} open tool call(s): ` +
             `thread=${state.threadId} turn=${turnId || state.turnId || 'unknown'} calls=${callIds.join(',')}`);
-        for (const [callId, name] of state.openToolCalls) {
-            yield {
-                type: 'tool_result',
-                name,
-                result: '',
-                isError: true,
-                error: 'Codex app-server ended the turn without an item/completed notification',
-                callId,
-            };
-        }
+        yield {
+            type: 'notice',
+            severity: 'warn',
+            subtype: 'missing-item-completed',
+            message: 'Turn completed before tool completion was received',
+            closedToolCallIds: callIds,
+            missingItems: openCalls.map(([itemId, toolName]) => ({ itemId, toolName })),
+        };
         state.openToolCalls.clear();
     }
     *mapAppServerItemStarted(item, state) {
@@ -3019,39 +3075,28 @@ export class CodexRunner {
         }
     }
     isTrustedSessionTempDir(directory) {
-        try {
-            const rawStat = fs.lstatSync(directory);
-            if (!rawStat.isDirectory() || rawStat.isSymbolicLink())
-                return false;
-            const parent = resolveProtectedCandidate(this.managedTempParent());
-            const canonical = resolveProtectedCandidate(directory);
-            for (const candidate of [parent, canonical]) {
-                const stat = fs.lstatSync(candidate);
-                if (!stat.isDirectory() || stat.isSymbolicLink())
-                    return false;
-                if (typeof process.getuid === 'function' && stat.uid !== process.getuid())
-                    return false;
-                if ((stat.mode & 0o077) !== 0)
-                    return false;
-            }
-            return canonical !== parent && isSameOrDescendant(canonical, parent);
-        }
-        catch {
-            return false;
-        }
+        return isTrustedManagedTempDirectory(directory, this.managedTempParent());
+    }
+    getManagedTempDir(sessionId) {
+        const directory = this.sessionTempDirs.get(sessionId);
+        if (!directory || !this.isTrustedSessionTempDir(directory))
+            return undefined;
+        return resolveProtectedCandidate(directory);
     }
     cleanupSessionTempDir(sessionId) {
         const directory = this.sessionTempDirs.get(sessionId);
         this.sessionTempDirs.delete(sessionId);
         if (!directory)
             return;
-        const parent = resolveProtectedCandidate(this.managedTempParent());
-        const candidate = resolveProtectedCandidate(directory);
-        if (candidate === parent || !isSameOrDescendant(candidate, parent)) {
+        // Reuse the same ownership, mode, lexical-parent, and canonicalization
+        // checks used at execution time. If the path changed, leave it in place
+        // rather than recursively removing an attacker-selected target.
+        if (!this.isTrustedSessionTempDir(directory)) {
             managedTempDirsForExitCleanup.delete(directory);
             logger.warn(`[CodexRunner] refused to clean unmanaged TMPDIR: session=${sessionId} path=${directory}`);
             return;
         }
+        const candidate = path.resolve(directory);
         try {
             fs.rmSync(candidate, { recursive: true, force: true });
             managedTempDirsForExitCleanup.delete(directory);
@@ -3063,7 +3108,7 @@ export class CodexRunner {
     managedTempInstruction(sessionId) {
         if (!this.ensureSessionTempDir(sessionId))
             return undefined;
-        return '临时文件必须使用环境变量 `$TMPDIR`。它指向当前 EvolCore 会话的受管临时工作区；不要直接使用 `/tmp`，也不要使用其他会话的临时目录。';
+        return '临时文件必须使用环境变量 `$TMPDIR`。它指向当前 EvolCore 会话的受管临时工作区；不要直接使用 `/tmp`，也不要使用其他会话的临时目录。当前是可持久化 thread 的恢复轮次，早先上下文中的 `/tmp/evolcore-codex-*` 绝对路径可能已经失效；不要重用旧路径。若文件不存在，请先在当前 `$TMPDIR` 重新创建，再继续执行后续 `ec` 命令。';
     }
     buildEvolcoreShellEnvironmentConfig(sessionId, delegationCarrier) {
         const managedTempDir = this.ensureSessionTempDir(sessionId);

package/dist/agents/ecagent-runner.js

@@ -967,6 +967,9 @@ export class EcagentRunner {
                     occurredAt: Date.now(),
                     toolName,
                     policyCode,
+                    decisionSource: 'policy',
+                    agentAid: permissionContext?.selfAid,
+                    permissionMode: mode,
                     summary: summarizeToolInputForAudit(toolName, operationInput).slice(0, 512),
                     effect: 'operation_skipped',
                 });
@@ -1003,7 +1006,7 @@ export class EcagentRunner {
                 sessionId, channel: permissionContext?.channel, peerId: permissionContext?.userId, role: permissionContext?.role,
             });
             if (decision.behavior === 'deny') {
-                await recordBlockedOperation('readonly_mode', checkedInput);
+                await recordBlockedOperation(decision.policyCode ?? 'readonly_mode', checkedInput);
                 return { block: true, reason: decision.message };
             }
             return {};